WPScan

No entries match these filters. Clear filters

1. v4.2.0 Oct 27, 2026 · issue 123

   WPScan v4.2.0 adds --max-response-size to cap response reads and improves SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. aborted-run reporting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.2.0 https://github.com/wpscanteam/wpscan.git
   # already have the repo? check out this version:
   $ git checkout v4.2.0

   └──▷ TRY IT
   Scan a target that serves unusually large pages without risking memory exhaustion — raise the cap to 64 MiB instead of the 16 MiB default.
   copy

   $ wpscan --url https://target.tld --max-response-size 64

   Persist a raised response-size cap in a project config file so every scan in this directory inherits it without repeating the flag.
   pwd/.wpscan/scan.yml copy

   cli_options:
     url: 'https://target.tld'
     max_response_size: 64

   • Adds --max-response-size MiB flag to stop reading any response once it exceeds the specified size (default 16 MiB, max 2047, 0 disables the cap), guarding against memory exhaustion on targets serving huge or endless responses.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • SARIF output now reports aborted runs as unsuccessful, with the abort reason recorded in toolExecutionNotifications, so consumers show an aborted scan as a failed analysis instead of a clean run with zero alerts.
   • Adds --max-response-size MiB flag to stop reading any response once it exceeds the specified size (default 16 MiB, max 2047, 0 disables the cap), guarding against memory exhaustion on targets serving huge or endless responses.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Responses larger than 16 MiB are now truncated by default; use --max-response-size 0 to restore the previous unbounded behavior.
2. v4.1.0 Jul 23, 2026 · issue 035

   WPScan v4.1.0 adds opt-in local vulnerability database for enterprise customers via --enterprise-db-token

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.1.0 https://github.com/wpscanteam/wpscan.git
   # already have the repo? check out this version:
   $ git checkout v4.1.0

   └──▷ TRY IT
   Scan a WordPress site using a local enterprise vulnerability database dump instead of online API calls, avoiding per-request limits.
   copy

   $ wpscan --url https://target.tld --enterprise-db-token <your-enterprise-token> --enumerate vp,vt

   Store the enterprise token in a config file so it's applied automatically to every scan without passing it on the CLI.
   yaml copy

   cli_options:
     enterprise_db_token: "<your-enterprise-token>"
     url: "https://target.tld"

   • Adds --enterprise-db-token TOKEN flag (also settable via the WPSCAN_ENTERPRISE_DB_TOKEN environment variable or the enterprise_db_token config-file key) to scan against a local vulnerability database dump instead of the online API, with no per-request limits.
   • When --enterprise-db-token is set, WPScan downloads plugins.json.gz, themes.json.gz, and wordpresses.json.gz from enterprise-data.wpscan.org (authenticated via the X-DB-JSON-AUTH header) and reads vulnerability data locally — API status is reported as plan enterprise with Unlimited requests remaining.
   • --enterprise-db-token and --api-token are mutually exclusive (including via their environment variables); supplying both raises an error, and the token is redacted from logged command lines.

   3 details in Everything

3. v4.0.0 May 19, 2026 · release notes

   WPScan 4.0 adds authenticated enumeration, SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface./JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. output, SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. support, backup-folder scanning, and PoC vuln data.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.0.0 https://github.com/wpscanteam/wpscan.git
   # already have the repo? check out this version:
   $ git checkout v4.0.0

   └──▷ TRY IT
   Pipe streaming results into a log file and a live processor simultaneously without waiting for the scan to finish.
   copy

   $ wpscan --url https://example.com -e ap --format jsonl | tee scan.jsonl | jq .

   Output SARIF for direct ingestion by GitHub Code Scanning or other SARIF-aware CI tooling.
   copy

   $ wpscan --url https://example.com -e ap,vp --format sarif -o wpscan.sarif

   • Adds --wp-auth option for WordPress Application Password authentication, enabling authoritative plugin/theme inventory via authenticated enumeration.
   • Adds --format sarif output format for direct CI/CD pipeline integration.
   • Adds --format jsonl streaming output format for real-time, line-by-line results consumption.
   • Adds --expect-saml flag to support SAML-protected WordPress targets.
   • Adds backup folder enumeration via -e backup-folders (alias -e bf).

   +11 more show less

   • Adds --exclude-vulns option to filter out specific vulnerabilities by UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. from scan output.
   • Adds --wordlist-skip N option to resume interrupted brute-force attacks at a specific wordlist offset.
   • Adds --max-retries N option for automatic retry of failed brute-force requests.
   • Adds --follow-redirect option to automatically follow HTTP redirects during scanning.
   • Adds --proxy-target-only option to route only target traffic through the proxy, leaving other requests direct.
   • Displays Proof-of-Concept information alongside vulnerability findings in scan output.
   • Shows active install counts and last-updated dates for detected plugins and themes sourced from WordPress.org API.
   • Includes audit metadata (command line and hostname) in scan output for traceability.
   • Streams plugin, theme, and user results to output in real-time as they are discovered.
   • Adds detection support for the SearchWP premium plugin via a new dynamic finder.
   • HTTP status code tracking now warns when excessive errors are detected during a scan.

   16 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Ruby 3.0, 3.1, and 3.2 are no longer supported; Ruby 3.3+ is now required.
   • !Plugin and config-backup enumeration is no longer performed by default; explicit -e ap (or other -e flags) must be passed to scan plugins.
   • !The --timthumbs-detection, --config-backups-detection, --db-exports-detection, and --medias-detection options have been removed.
   • !New installations use XDGXDGA set of specifications maintained by freedesktop.org that standardise where Linux applications store config, data, and cache files, letting tools respect user-defined paths instead of hardcoding locations. Base Directory paths (~/.cache/wpscan/db and ~/.config/wpscan/) instead of ~/.wpscan/.
   • !--plugins-list and --themes-list now override -e options rather than combining with them.
4. v3.8.13 Jan 12, 2021 · release notes

   WPScan v3.8.13 adds --force flag and new php_disabled detection check

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.8.13 https://github.com/wpscanteam/wpscan.git
   # already have the repo? check out this version:
   $ git checkout v3.8.13

   • Adds the --force CLI option to scan a target even when availability checks return a 403 error
   • Introduces the php_disabled InterestingFinding check to detect if PHP is disabled on the target

   2 details in Everything

5. v3.7.10 Mar 9, 2020 · release notes

   WPScan v3.7.10 adds ENV-based API token loading.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.7.10 https://github.com/wpscanteam/wpscan.git
   # already have the repo? check out this version:
   $ git checkout v3.7.10

   • WPSCAN_API_TOKEN environment variable is now supported to load the API token.

   1 detail in Everything

6. v3.7.9 Feb 29, 2020 · release notes

   WPScan v3.7.9 adds target IP to output and optimizes scanning performance for sites with many links.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.7.9 https://github.com/wpscanteam/wpscan.git
   # already have the repo? check out this version:
   $ git checkout v3.7.9

   • Adds the target IP address to the scan output
   • Reduces time to detect non-WP sites when the homepage contains many links
   • Reduces passive scanning time when the homepage contains many links

   3 details in Everything

7. v3.7.4 Nov 5, 2019 · release notes

   WPScan v3.7.4 adds Windows support and new 404-based detection capabilities.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.7.4 https://github.com/wpscanteam/wpscan.git
   # already have the repo? check out this version:
   $ git checkout v3.7.4

   • Enables detection of WP version, Plugins, Themes, Main Themes and their versions from 404 responses

   1 detail in Everything

8. v3.6.0 Jul 11, 2019 · release notes

   WPScan v3.6.0 adds DF config override for potential readme filenames to reduce false positives

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.6.0 https://github.com/wpscanteam/wpscan.git
   # already have the repo? check out this version:
   $ git checkout v3.6.0

   • Adds support for overriding potential Readme filenames via the DF config, reducing requests and avoiding false positives from old files
   • Changes default behavior so Plugin and Theme Versions Dictionaries are created on demand rather than at startup

   2 details in Everything

9. v3.4.5 Mar 10, 2019 · release notes

   WPScan v3.4.5 adds wp-cron.php detection and improves XML-RPCXML-RPCA remote procedure call protocol that encodes calls and responses as XML over HTTP, letting a client invoke functions on a remote server without a custom binary protocol. detection engine.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.4.5 https://github.com/wpscanteam/wpscan.git
   # already have the repo? check out this version:
   $ git checkout v3.4.5

   • Adds wp-cron.php detection via CMSScanner 0.0.41.4
   • Improves Debug Log and XML-RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. detections via CMSSCanner 0.0.41.4

   2 details in Everything

10. 2.9.4 Jun 15, 2018 · release notes

    WPScan 2.9.4 adds offline DB updates, robots.txt status checks, RSS author info, and new human-readable file detections.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.9.4 https://github.com/wpscanteam/wpscan.git
    # already have the repo? check out this version:
    $ git checkout 2.9.4

    • Adds offline mode to update the local vulnerability database without network access
    • Checks HTTP status codes for every URL found in robots.txt during enumeration
    • Extracts author information from WordPress RSS feeds
    • Detects existence of humans.txt and security.txt files
    • Follows HTTP redirections (e.g., http to https) during target probing

    5 details in Everything

11. 2.9.3 Jul 19, 2017 · release notes

    WPScan v2.9.3 adds stdin wordlist input via --wordlist - and configurable log filename to --log.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.9.3 https://github.com/wpscanteam/wpscan.git
    # already have the repo? check out this version:
    $ git checkout 2.9.3

    └──▷ USE IT
    Pipe a dynamically generated wordlist into WPScan instead of using a static file.
    shell copy

    cat /tmp/wordlist.txt | wpscan --url https://example.com --wordlist -

    Save the scan log to a specific file instead of the default location.
    shell copy

    wpscan --url https://example.com --log my_scan_output.log

    • Adds --wordlist - flag to pass a custom wordlist from standard input
    • Adds optional filename parameter to the --log option

    2 details in Everything

12. 2.9.2 Nov 15, 2016 · release notes

    WPScan 2.9.2 adds --cache-dir and --disable-tls-checks options

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.9.2 https://github.com/wpscanteam/wpscan.git
    # already have the repo? check out this version:
    $ git checkout 2.9.2

    └──▷ TRY IT
    Store scan cache in a specific directory for shared access or persistence
    copy

    $ wpscan --url https://example.com --cache-dir /path/to/cache

    Scan a target behind a proxy with self-signed or invalid TLS certificates
    copy

    $ wpscan --url https://example.com --disable-tls-checks

    • Adds the --cache-dir option to specify a custom directory for caching data
    • Adds the --disable-tls-checks option to bypass TLS certificate verification during scans

    2 details in Everything

13. 2.9.1 May 6, 2016 · release notes

    Adds Windows support and WordPress metadata display in WPScan 2.9.1

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.9.1 https://github.com/wpscanteam/wpscan.git
    # already have the repo? check out this version:
    $ git checkout 2.9.1

    • Added experimental Windows support
    • Display WordPress metadata on the detected version

    2 details in Everything

14. 2.9 Oct 15, 2015 · release notes

    WPScan v2.9 adds --throttle option for rate-limiting requests and introduces APIv2 support with GZIP compression.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.9 https://github.com/wpscanteam/wpscan.git
    # already have the repo? check out this version:
    $ git checkout 2.9

    └──▷ USE IT
    Scan a site while sending fewer requests per second to avoid overwhelming the server or triggering WAFs.
    shell copy

    wpscan --url https://example.com --throttle 0.5

    • Adds --throttle CLI argument to throttle request rates
    • Switches updater to use GZIP encoding (improved performance/compression)
    • Integrates new APIv2 structure replacing legacy APIv1 local databases

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The APIv1 local database format is removed; users must migrate to or use the new APIv2 structure.
15. 2.8 Jun 22, 2015 · release notes

    WPScan 2.8 adds --no-banner flag and displays last DB update time via --version.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.8 https://github.com/wpscanteam/wpscan.git
    # already have the repo? check out this version:
    $ git checkout 2.8

    • Adds --no-banner option to suppress the startup banner.
    • Includes last database update timestamp in --version output.
    • Displays database checksum during verbose update logging (-v).

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Switches underlying TLS library from gnutls to openssl.